Fake Amazon Business Ads on Google Trick Users Into Installing Infostealers

Huntress investigated multiple incidents that began with a sponsored Google search result for the keywords "amazon business". The ad led to a spoofed Amazon login page with an embedded ClickFix prompt, a fake CAPTCHA that asks the victim to run a command on their own computer. The command then downloads a malicious payload from attacker-controlled infrastructure. Huntress says the method has already affected at least three of its customers.

What sets this campaign apart is the tool it abuses. The command calls on finger, a decades-old Windows network utility that few people use or understand, as a living off the land binary (a legitimate built-in tool used for malicious purposes). It starts a convoluted, heavily obfuscated chain of scripts that ends with several payloads on the victim's computer. These include a pirated copy of the NetSupport Client remote monitoring and management tool and a version of Lumma Stealer. Huntress reports at least three different kinds of infostealer and remote access malware were installed. Threat actors have been using finger in ClickFix attacks for at least a year.

Google has removed the malicious ad, but the attacker infrastructure remains online and functional. It appears to favour a growing list of barbecue-themed domain names. Huntress has also seen ClickFix lures that imitate ChatGPT, Google Docs and other trusted tools in recent months, showing how often attackers lean on familiar brands.